I am trying to force encryption when transferring a file to a removable storage, but I could not figure how.

The scenario is that a user plugs in a USB memory stick which may already contain some files. The user tries to copy a file from the local filesystem to the memory stick. The file is encrypted on the fly transparently and the copied file on the memory stick is now encrypted. This should not be optional but mandatory. The user without root privilege should not be able to bypass this, and transfer unencrypted files to the memory stick.

What I am looking for is I think "Stacked filesystem encryption" not a block device encryption as I do not want to encrypt a whole drive but only the files written to it (also I do not want to encrypt the files already present on the memory stick).

The closest I could get to the solution was encfs, but it does not force encryption to the whole memory stick, but rather creates an encrypted folder on the memory stick and encrypts only if the files are copied to that folder. I tried mounting the root folder of the usb disk but that got messy as it was already mounted by the filesystem.

Probably I should implement this as a kernel module but I wonder if there is an existing solution for my problem or a workaround?


1 Answer 1


The best you can do here is use a LUKS volume as the only partition on the USB memory stick and then create an ext4 file system inside that LUKS volume. Note, however, that such a configuration will probably require root privileges to mount, since udisks probably does not know how to handle that transparently. You may wish to create a setuid helper to paper over this.

You could also try formatting the USB drive with ext4 with encryption, although when I looked last, that was still experimental. It is also not as secure as a full encrypted block device, but it may be good enough for your needs.

There are also special USB memory sticks that require the user to enter a PIN on the device to decrypt it before it will be recognized as a memory stick.

If your goal is not to create a single secure memory stick but to force all accesses to all USB memory sticks to be encrypted, then your solution is either to remove all USB modules from the kernel or to give up and epoxy all the USB ports permanently closed. There are a variety of USB devices and protocols that can be used to transfer data, and many of those happen in userspace, such as MTP (which is used to transfer data to Android phones), so if you can get the kernel to recognize a USB device, then you can probably get data off the device unencrypted. That's just the way it is.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.